sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run via sudo executed wordexp() C library function with a user supplied argument. A local user permitted to run such application via sudo with noexec restriction could possibly use this flaw to execute arbitrary commands with elevated privileges.
Published at: May 29, 2018 at 06:29PM
View on website
New vulnerability on the NVD: CVE-2016-7076
Tag: government hack NVD security
No comments: